vulnerability

Red Hat: CVE-2022-25883: Regular expression denial of service (Multiple Advisories)

Name: Red Hat: CVE-2022-25883: Regular expression denial of service (Multiple Advisories)
Creator: Red Hat
Published: 2023-06-21T00:00:00.000Z
Keywords: CVE, CWE-1333, Red Hat, 2022, 25883, Regular expression denial of service (Multiple Advisories), redhat-upgrade-nodejs, redhat-upgrade-nodejs-debuginfo, redhat-upgrade-nodejs-debugsource, redhat-upgrade-nodejs-devel, redhat-upgrade-nodejs-docs, redhat-upgrade-nodejs-full-i18n, redhat-upgrade-nodejs-nodemon, redhat-upgrade-nodejs-packaging, redhat-upgrade-nodejs-packaging-bundler, redhat-upgrade-npm, Severity 8

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:C)

Published

Jun 21, 2023

Added

Sep 27, 2023

Modified

Jun 17, 2026

Description

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Solutions

redhat-upgrade-nodejsredhat-upgrade-nodejs-debuginforedhat-upgrade-nodejs-debugsourceredhat-upgrade-nodejs-develredhat-upgrade-nodejs-docsredhat-upgrade-nodejs-full-i18nredhat-upgrade-nodejs-nodemonredhat-upgrade-nodejs-packagingredhat-upgrade-nodejs-packaging-bundlerredhat-upgrade-npm

References

CWE-1333
EUVD-EUVD-2023-1769
NVD-CVE-2022-25883
REDHAT-RHSA-2023:5360
REDHAT-RHSA-2023:5361
REDHAT-RHSA-2023:5362
REDHAT-RHSA-2023:5363
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-1769

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report